Knowledge · documents

Archiving Emails in Compliance with GoBD: What Is Mandatory

Which emails you must retain, when the email itself becomes a record, and how to automatically secure attachments like invoices in a GoBD-compliant way.

Emails must be archived in compliance with GoBD if they are relevant for tax purposes – that is, if they serve as a business letter or accounting record, for example with quotes, order confirmations, or invoices as attachments. Not every email is affected: pure transport messages ("please find our invoice attached") without their own business content are generally not subject to retention – but their attachment is.

Which emails you must retain

The function decides, not the medium. An email is typically subject to retention if it

• prepares, concludes, carries out, or reverses a transaction (commercial/business letter),
• itself serves as an accounting record or documents terms, prices, and commitments,
• transports an attachment subject to retention – in which case at least the attachment must be secured.

Newsletters, internal scheduling arrangements, or spam do not fall under this. Mixed cases are trickier: if the email accompanying an invoice attachment also states "as discussed, we grant a 5% discount," the email itself is business-relevant and belongs in the archive.

Why the mailbox is not an archive

A normal mailbox barely meets the GoBD requirements on its own: emails can be deleted, moved, mailboxes fill up, or are dissolved when employees change. The GoBD, by contrast, require immutability, completeness, and orderly findability over years. So you need a process that transfers relevant content from the mailbox into a protected storage.

The practical approach: secure attachments automatically

For most small businesses, the most important lever is the flow of records by email – above all incoming invoices. You can fully automate this part: webRichtung documents connects via IMAP to your company's mailboxes and automatically imports incoming attachments. The following applies:

• The attachments are imported, the email context (sender, subject, receipt date) is retained as search and audit context.
• A start date controls the historical import – so you can also clean up retroactively.
• Imported documents go through normal processing: reading, classifying, making searchable – and then end up in the GoBD archive with Object Lock for 6, 8, or 10 years.

What the setup looks like in detail is described in the article Importing documents by email; the technical documentation can be found at docs.webrichtung.de/documents.

A simple rule for the team

To ensure that as little as possible falls through the cracks in everyday work, a clear convention helps: business-relevant correspondence runs through defined company mailboxes (e.g. rechnung@, info@), not through private addresses – because only connected mailboxes are secured automatically. Whatever comes in as an attachment lands in storage by itself; emails with their own contractual content you additionally file deliberately.

Quick check for your company

• Do invoices and order confirmations come in through defined company mailboxes?
• Are attachments automatically transferred into a protected storage – or does this depend on a single person?
• Can the archived records be found by content, date, and amount?
• Is it regulated what happens to old emails when mailboxes are dissolved and staff changes?

If you answer a question with no, that is the point you should start with – usually an afternoon of setup is enough instead of a project.

This article provides general information and does not replace legal or tax advice.

Markdown · Text